[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <D9ABD55E-B4E7-4713-89DA-9FC17DAA7DF1@thermi.consulting>
Date: Wed, 07 Oct 2020 20:07:34 +0000
From: Noel Kuntze <noel.kuntze@...rmi.consulting>
To: oss-security@...ts.openwall.com
Subject: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022
Hi,
It'd be sensible for the mode to be 751 and have public_html and, for example, a hypothetical "share" directory to have mode 755.
Kind regards
Noel
Am October 7, 2020 7:18:56 PM UTC schrieb Jeremy Stanley <fungi@...goth.org>:
>On 2020-10-07 21:00:35 +0300 (+0300), Georgi Guninski wrote:
>> https://lists.debian.org/debian-security/2020/10/msg00000.html
>>
>> ===
>> /home/loser is with permissions 755, default umask 0022
>>
>> on multiuser machines this sucks much.
>>
>> on a multiuser debian mirror we found a lot of data,
>> including the wordpress password of the admin.
>> ===
>
>It's tradition that on multi-user systems, users would want to share
>data with one another and also serve content from their home
>directories in Web sites. Further, it's not at all uncommon for
>sysadmins to not understand or consider the system defaults when
>making deployment decisions and failing to secure sensitive files.
>
>As a long-time Debian user myself, I agree that this default is
>showing its age, and can represent a risk for operators who overlook
>it.
>
>> Then in the thread someone with @debian.org email explains
>> to me it is a feature, not a bug.
>
>Nowhere in that response do they call it a feature, and it's
>disingenuous of you to imply that they did. It's a default, which is
>almost always going to be a balance between two (or more) competing
>needs. Also, I encourage you to take a guess at how many people
>there are "with @debian.org email" (hint, it's not a small number).
>
>A more informative response would probably have been to point you to
>https://wiki.debian.org/Debate/umask which provides pointers to
>where and how this would need to be solved in the long run.
>
>> In a addition, they suggest to tell them the mirror, lol.
>
>Yes, do you fault them for wanting to remove a likely compromised
>server from the network of volunteer-run package mirrors?
>
>> Are debian detached from reality?
>
>Your brusque and insulting attitude (saying their choices suck,
>calling them detached from reality, laughing at their explanations)
>is likely to trigger glib responses and cause people to be less
>inclined to pay attention to what you have to say.
>--
>Jeremy Stanley
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
